[2171528] Type 1 font-loader `.forceput` save/restore UAF yields native read/write and controlled dispatch/RCE under `-dSAFER`

https://bugs.launchpad.net/bugs/2171528